8 ms·
Dropbox disables ASLR on Windows
- sitkack 13y agoI have always suspected dropbox was a rootkit trojan. Ever since the founder said that it was open to sifting through users data for copyright violations.
- immad 13y agoCitation Needed.
- toomuchtodo 13y agoThis is the closest thing I could find googling for 45 seconds: http://www.pcworld.com/article/226280/dropbox_a_file_sharers_dream_tool.html http://www.pcworld.com/article/226280/dropbox_a_file_sharers... https://news.ycombinator.com/item?id=2483053 https://news.ycombinator.com/item?id=2483053
- sillysaurus2 13y agoWhere and when did Drew say that?
- AsymetricCom 13y agoOf course it is, but so is a lot of "consumer driven" technology these days.
- tlrobinson 13y agoASLR = Address Space Layout Randomization https://en.wikipedia.org/wiki/Address_space_layout_randomization https://en.wikipedia.org/wiki/Address_space_layout_randomiza...
- ash 13y agoThank you! Search engines are spoiling us. Entire article about an acronym that doesn't bother decyphering or explaining it.
- spc476 13y agoI'm surprised that more people don't wrap such acronyms (or abbreviations) in <ACRONYM> or <ABBR> tags (at least the first time it's used in a page or article).
- TazeTSchnitzel 13y agoSome wiki software even does that automatically! http://wiki.php.net/rfc http://wiki.php.net/rfc
- spc476 13y agoThere are issues with doing it automatically though: http://boston.conman.org/2003/11/19.2 http://boston.conman.org/2003/11/19.2
- ricardobeat 13y agoAnd ROP = Return-oriented programming http://en.wikipedia.org/wiki/Return-oriented_programming http://en.wikipedia.org/wiki/Return-oriented_programming
- RachelF 13y agoYou can try the Microsoft EMET toolkit to force ASLR: http://support.microsoft.com/kb/2458544 http://support.microsoft.com/kb/2458544
- scott_karana 13y ago> Update: Brad “spender” Spengler (of grsec fame) has noted that the latest version of Dropbox has ASLR enabled for the 64-bit DLL, but still doesn’t on 32-bit. For those particularly worried. Still disturbing, but this seems to point to technical concerns.
- mavhc 13y agoAlthough that version isn't offered from the main dropbox page, you have to go to https://www.dropbox.com/release_notes https://www.dropbox.com/release_notes
- newman314 13y agoDirect link? I can only see the Linux x86_64 version and not one for Win 64bit.
- jcampbell1 13y agoDoes ASLR do anything for the 32-bit address space? It seems like you could enumerate it and find libc in a few seconds. I am mostly talking out of my ass here, as I am no expert on these subjects.
- keeperofdakeys 13y agoMost malicious software uses fixed-offsets, so any kind of ASLR makes all this not work. And while it's possible to search the address space, in practice this is actually quite hard, even for 32-bit.
- revelation 13y agoIf you can execute code, you could certainly do that, even on 64 bit. The problem is executing code in the first place. There are other mechanisms in place that can prevent a crash to turn into direct code execution (NX-bit). To circumvent those, you can use Return Oriented Programming (ROP), where you prepare the stack such that you jump into a loaded library or other (completely innocent!) code in memory. The problem then is that you need to know where the code you want to jump to resides in memory, and thats where ASLR comes in. With ASLR, modules are randomly allocated in memory and an attacker can't predict where code he wants to jump to resides at. (ROP is a pretty fascinating topic in itself. The problem is essentially that you are given a bunch of assembly, and your task is to figure out how to use, combine it into gadgets that emulate generic computing functionality (pop a value from the stack, push a value to the stack, call a function, ..) such that you can build your shellcode from those gadgets)
- SilliMon 13y agoWhat's most worrying about this is that Dropbox is injecting itself into processes like NotePad++ and Firefox that have nothing to do with shell extensions. Either this is lazy coding, or there is some malicious intent to spy.
- elehack 13y agoThey use the standard file open dialog, which in turn supports shell extensions.
- Dylan16807 13y agoSo it doesn't disable ASLR outside of this dll, right? The process is already loaded; it can't un-randomize.
- lawnchair_larry 13y agoIt doesn't need to. The attacker can just target the dropbox DLL now, which is more than enough to execute a payload. Having 1 module inject itself without ASLR means you may as well not be running ASLR on the process at all.
- Dylan16807 13y agoNot everything is equally exploitable.
- lawnchair_larry 13y agoIt is when the non-ASLR Dropbox dll is injected. That's the point.
- wtallis 13y agoI think the point was that the attack surface of the Dropbox DLL is not necessarily the same as the attack surface of an entire web browser running without ASLR. Do you have reason to state otherwise, or are you just trying to say that you think the Dropbox DLL is so full of vulnerabilities that it would always be the easiest attack vector even for a process that didn't use ASLR at all?
- aparadja 13y agoI think the idea is to still find your vulnerability in the browser as usual, but abuse the unrandomized Dropbox DLL for executing the payload. So, the DLL isn't directly attacked. It's simply used to circumvent ASLR.
- 13y ago
- lawnchair_larry 13y agoThat's very bad. It's been a long battle to stomp out ASLR-breaking modules from browsers. Vendors who do this undermine all of that.
- onehoof 13y ago"Dropbox" and "Security" are pretty much opposing terms. Remember this is the same company that when faced with a login bug, chose to disable password authentication so that anyone could log in as anyone else instead of shutting the service down until it was fixed.
- api 13y agoName one company that's gone out of business because of a security problem, or even had their business significantly impacted. I can't. I'm sure if you dig you could find one, but I'm not aware of one off the top of my head. Until this sort of thing matters to users, nothing will change.
- habosa 13y agoI bet the recent Developer Site outage had a business impact for Apple. Might be impossible to measure though.
- jerf 13y agoSony: http://www.computerworld.com/s/article/9216926/PlayStation_Network_hack_will_cost_Sony_170M http://www.computerworld.com/s/article/9216926/PlayStation_N... You can quibble about the numbers; the article doesn't come out and say it but the exact number may have been subject to some accounting shenanigans (probably the fully-legal kind, but that still leaves leeway). But it did cost them, both money and reputation. That said, I tend to agree with your general point. But companies don't quite get off entirely without consequence... it's just rare enough that it's more like a bolt from the blue than a reliable penalty.
- chrischen 13y agoI think they factored into the cost the two free games and identity theft protection that they voluntarily offered. The two free games were nice too. They gave us choices from top rated titles.
- bigiain 13y agoLavabit?
- timpattinson 13y agoComments from /r/netsec thread here: http://www.reddit.com/r/netsec/comments/1m25gi/installing_dropbox_prepare_to_lose_aslr/ http://www.reddit.com/r/netsec/comments/1m25gi/installing_dr...
- deleted 13y ago[deleted]
- caiob 13y agohow about less acronyms?
- lutusp 13y ago>how about less acronyms? Or, better, how about fewer acronyms?
- chris_wot 13y agoNo.
- daave 13y agoThat's a rather US-centric remark. 'less' is an acceptable comparative for both countable and uncountable nouns in all modern dialects of English except for US-English, where it's strictly expected that fewer be used for countables. Perhaps caiob is from the UK, Australia, India, South Africa, New Zealand...
- timthorn 13y agoIt's not acceptable in the UK: http://www.telegraph.co.uk/news/uknews/2659948/Tesco-to-ditch-ten-items-or-less-sign-after-good-grammar-campaign.html http://www.telegraph.co.uk/news/uknews/2659948/Tesco-to-ditc...
- 13y ago
- Theriac25 13y agoWhy is it even possible for DLLs/applications to disable ASLR by themselves, shouldn't that be decision for the OS or admin?
- asveikau 13y ago> Why is it even possible for DLLs/applications to disable ASLR by themselves Compatibility with old apps. There is software out there in the world that relies on the address space not changing, either deliberately or due to bugs. You could argue that they shouldn't do that, but people get pissed when their stuff doesn't work with the new Windows. The most cautious thing they can do for these apps is make it opt-in. (I believe the default may be different for amd64? Not sure..) > decision for the ... admin I believe the policy is also a system setting, and maybe even you can override the value in the PE header this way.
- yalogin 13y agoInteresting. The option /DYNAMICBASE seems to be the default (to support ASLR). Which means they explicitly disabled it. Wonder why? Are they doing something that needed ASLR to be off?
- taspeotis 13y agoWe have an application that builds with a variety of misconfigured options (by modern standards). We fix 'em when we see 'em. It's a result of upgrading from VC++4, to VC++5, to VC++6, to VS2003, to VS2005, to VS2008. They're set by the project upgrade wizard, for compatibility reasons. Which is not to say that Dropbox didn't manually set the flag, I'm unsure if /DYNAMICBASE is set or unset for the sake of compatibility.
- rossy 13y agoIt's possible they're using an older version of MSVC or an alternative compiler. I don't think /DYNAMICBASE is on by default in VS2005/2008 and it's definitely not on by default in MinGW GCC.
- andyjohnson0 13y agoI know very little about ASLR. Anyone care to comment on possible reasons why Dropbox would disable it? I find it hard to believe that this is a deliberate attempt to weaken client-side security, so its more likely that they are using some legacy code that is somehow incompatible with ASLR. But ASLR has been in Windows since 2007, pre-dating Dropbox by about a year, so they either developed ASLR-incompatible code after the feature was live or the problem is in a third-part component. Any other explanations? What problems can ASLR cause?
- wepple 13y agoif a single dll loaded by dropbox hasn't been compiled with /DYNAMICBASE to instruct the OS to allow ASLR, Dropbox will have some reliable memory addresses available to an attacker, often defeating the purpose of using it on anything. Perhaps they're using an old or unusual linker?
- andyjohnson0 13y agoI understand about the /DYNAMICBASE flag, but I has hoping to understand why they would choose to not set it. My assumption is that they disabled it for stability/reliability reasons that are specific to their application, and I was further hoping to understand what kind of bugs could be triggered by having ASLR enabled. I've written plenty of C and C++ over many years and can't think of any bugs that I've introduced or found where assumptions about address place layout were involved. Since we're talking about Windows, I assume they're using Visual Studio and its linker.
- Ono-Sendai 13y agoIt can slow down your program slightly and cause non-deterministic performance. This shouldn't really be an issue for Dropbox though.
- deleted 13y ago[deleted]
- trurl42 13y agoIt seems like git-cheetah and the 7-Zip shell extension exhibit the same problem. MinGW doesn't enable ASLR by default, which might be the reason for that.